MalwareUsed by 2 actors

Poco RAT

Poco RAT is a remote access trojan used in campaigns against Spanish-speaking organizations in Latin America, including the mining sector. Activity distributing the malware has been attributed to Dark Caracal, also known as Darkling APT, an espionage-focused threat actor. Documented campaigns use phishing emails with malicious PDF attachments that direct recipients to download intermediate files from file-sharing services; those files execute droppers that install Poco RAT. The malware provides remote control of compromised endpoints, supports command execution, and collects system information. Dark Caracal has also distributed Poco RAT through financial-themed phishing as part of cyber-espionage operations.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Dark Caracal

A new campaign distributing Poco RAT to Spanish-speaking users in Latin America has been reported in the wild.

via broadcombroadcom.com

Darkling APT

A new campaign distributing Poco RAT to Spanish-speaking users in Latin America has been reported in the wild.

via broadcombroadcom.com

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence2

The Poco RAT malware is spread via phish email messages containing malicious PDF attachments.

T1566.001Spearphishing AttachmentEvidence1

The Poco RAT malware is spread via phish email messages containing malicious PDF attachments.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

The dropped payloads provide the attackers with remote control of the compromised machine, command execution and system information collection, among others.

T1204.002Malicious FileEvidence1

The attached files redirect the victims to the download of .rev files from often legitimate file-sharing services. The downloaded .rev files lead in turn to execution of malware droppers that infect the targeted endpoints with the Poco RAT payload.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

The dropped payloads provide the attackers with remote control of the compromised machine, command execution and system information collection, among others.

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

The attached files redirect the victims to the download of .rev files from often legitimate file-sharing services.

T1219Remote Access ToolsEvidence2

The dropped payloads provide the attackers with remote control of the compromised machine, command execution and system information collection, among others.

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

the hacker newsNews

Sep 3, 2026

BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory

A remote-access trojan mentioned only as the predecessor of AsioGate.

recorded future blogNews

Apr 2, 2026

Latin America and the Caribbean Cybercrime Landscape

A remote access trojan delivered through financial-themed phishing in cyber espionage activity.

cloudatg insightsNews

Feb 13, 2026

AI Development & Software Engineering | CloudATG

Remote access trojan with espionage features (e.g., file upload, screenshots) used by Dark Caracal against Spanish-speaking enterprises in Latin America.

huntio blogNews

Jun 12, 2025

Stealth Falcon’s Zero-Day Offensive, OilRig’s Supply Chain Escalation, and the Evolving Middle Eastern APT Landscape

Remote Access Trojan (RAT) used by Dark Caracal for espionage, often delivered via phishing and fileless techniques.

+3 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Poco RAT